A vulnerability (CVE-2026-6770) has been discovered in the Gecko browser engine, allowing the generation of unique identifiers for tracking the opening of different websites from a single browser. This issue manifests across all Firefox-based browsers, including Tor Browser, and operates even in private browsing mode. Identifiers exist within the current browser process and reset upon browser restart. The vulnerability has been fixed in Firefox releases 150/140.10.0 and Tor Browser 15.0.10.
To generate an identifier, it is sufficient to create identical database sequences through the IndexedDB API on different websites, after which the order of these databases can be assessed using the indexedDB.databases() method. For different browser instances, the order of database enumeration will differ, but will repeat for a single instance. This order persists until the browser is restarted and is reproduced regardless of the websites opened.
For example, after creating a database "a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,r" in one instance of Firefox, the indexedDB.databases() method will consistently return "g,c,p,a,l,f,n,r,d,j,b,o,h,e,m,i,k" in that instance, while another will return "j,b,o,h,e,m,i,k,f,n,r,d,g,c,p,a,l". With 16 databases created, about 44 bits of entropy can be obtained for identification. The generation of an identifier is unaffected by the clearing of local browser storage and the updating of Tor node chains using the "New Identity" button in Tor Browser. This method can also be used for user identification in private browsing windows.
The vulnerability arises from the implementation specifics of the IndexedDB API, where the order of database enumeration is influenced by the arrangement of internal structures unique to each instance of the browser's worker process. The order of elements in the list of databases returned by the indexedDB.databases() method depends not on the names of the databases or their creation order, but on the placement of internal UUID hashes associated with the filenames where the databases are stored on disk in the global hash table.
Source: opennet.ru
